This invention relates to establishing and operating virtual private data networks.
Virtual private networks (VPNs) leverage the flexibility and cost advantages of the Internet by passing information over the Internet, or other shared Internet Protocol (IP) network, in a secure manner. VPNs enable enterprises to securely bridge geographically separated computers or local networks over the Internet as an alternative to using expensive, leased-line networks and other remote-access solutions. Internet Service Providers (ISPs), recognizing the benefits of VPNs, are beginning to offer multi-tiered VPN services to their customers.
Businesses, recognizing the benefits of VPNs, employ VPNs to support a wide variety of connectivity needs including remote dial-up access for telecommuters and mobile users, private line augmentation and replacement of existing leased-line and frame relay networks, extranet networking for secure and controlled wide area access to corporate information resources by their business partners, and segmented intranet networking for secure partitioning of internal traffic across both the wide area and the local area.
An important impetus for the adoption of VPN technology by businesses is the significant cost saving associated with the replacement of expensive remote access servers and associated long distance dial-up charges, the substitution of inexpensive and ubiquitous Internet access for expensive leased lines and frame relay access, and the introduction of a flexible, fast, secure, and inexpensive mechanism for exchanging data with suppliers and customers.
At the present time, a number of standards and proprietary schemes exist for encrypting and authenticating data packets that traverse public or private data networks. In December 1995, the Internet Engineering Task Force (IETF) published five Requests for Comments (RFCs) that define formats and methods for encrypting and authenticating Internet Protocol (IP) packets. More recently, the IETF has published a series of Internet Drafts that update the formats and methods for encrypting and authenticating IP packets. The IETF initiative is called Internet Protocol Security (IPSec).
The IETF is currently in the process of defining a data link layer security protocol that is known by the name Layer 2 Tunneling Protocol (L2TP). L2TP encapsulates data link layer PPP frames and transmits them across public data networks by prepending an IP header to the encapsulated PPP frames.
Microsoft Corporation has implemented a proprietary data link layer security protocol called Point to Point Tunneling Protocol (PPTP) that encrypts data layer PPP frames and transmits them across public data networks by prepending an IP header to the encrypted PPP frames.
The IETF has also published a series of Internet Drafts intended to address the standardization of a key management protocol by which IPSec devices negotiate their security associations and keying material. The original name for this key management scheme was called ISAKMP/OAKLEY; the more current name is the Internet Key Exchange (IKE).
In one aspect, in general, the invention is a node device for providing secure communication services over a data network, such as the Internet or another public or private packet-switched network, to multiple computers that are coupled through the node device and multiple other node devices. The node device includes a network communication interface for coupling the node device to the data network. For example, the network communication interface is an Ethernet interface that is coupled to a cable modem or a digital subscriber loop (DSL) modem or a serial interface coupled to a telephone modem for communicating with an Internet service provider. The node device is, for example, an edge device located at a customer premises or at an Internet POP, a network device located at an intermediate point in the Internet, or can be implemented in software on a computer at the customer premises. The node device includes a data storage containing cryptographic information including information that is private to the node device. The information that is private to the node device can include a private key of a public/private key pair known only to the node device, and can further include a certificate, such as a X.509 format certificate, which includes a public key of the public/private key pair. The node device also includes a tunneling communication service coupled to the network interface and is configured to maintain an encrypted communication tunnel with each of the multiple other node devices using the cryptographic information. For example, the encrypted communication tunnels are implemented using the IPsec or PPTP protocols. The node device further includes a routing database for holding routing data and a router coupled to the tunneling communication service and to the routing database. The router is configured to accept communication from a first of the computers that includes an address of a second of the computers, to select one of the other node devices based on the address of the second computer and the routing data, and to pass the communication through the encrypted communication tunnel to the selected node device.
The node device can include one or more of the following features:
The router accepts the communication from the first of the computers from the tunneling communication service after that communication is received by the tunneling communication service through one of the encrypted tunnels to the other node device.
The node device further includes a management module configured to communicate with a server over the data network, to use the information in the data storage that is private to the node device for authentication with the server, and to accept cryptographic information from the server for storing in the data storage for use by the tunneling communication service in maintaining the encrypted tunnels.
The management module is configured to receive communication policy information from the server, for example information that the node device uses to limit or prioritize communication between node devices.
The node device further includes a local communication interface, such as an Ethernet interface, coupling the node device to the first of the computers. The router accepts the communication from the first of the computers through the local communication interface.
The node device further includes a communication agent coupled to the local communication interface configured to accept a broadcast communication from the first of the computers. That broadcast communication is addressed to a multiple of other devices, for example being a message broadcast according to the BOOTP or DCHP protocol, or another type of request for configuration data from the first local computer. The communication agent is configured to forward the communication over one or more of the encrypted communication tunnels to the other node devices.
The communication agent can select one or more of the encrypted communication tunnels prior to forwarding the communication. For example, a DCHP message can be forwarded over a single tunnel to another node device to which a DCHP server is locally coupled, thereby avoiding forwarding the broadcast communication to other node devices to which DCHP servers are not connected. Selecting the tunnels can be based on configuration data provided by a management server.
The router is further configured to accept routing data over the encrypted communication tunnel from the other node devices, for example according to the RIPv2 or OSPF protocols, and to update the routing database using the accepted routing data.
Each of the encrypted communication tunnels belong to one of multiple sets of tunnels, or VPN xe2x80x9cdomains,xe2x80x9d and the router is configured to prevent forwarding of communication received from a tunnel in one domain to a tunnel in another domain.
In another aspect, in general, the invention is a node device for providing secure communication services over a data network to multiple computers that are coupled through the node device and multiple other node devices. The node device includes a data storage containing cryptographic information including information that is private to the node device, a routing database for holding routing data, and a processor. The processor is programmed to implement a tunneling communication service for maintaining an encrypted communication tunnel with each of the plurality of other node devices using the cryptographic information, and to implement a router configured to accept communication from a first of the computers, the communication including an address to a second of the computers, the router being further configured to select one of the other node devices based on the address of the second computer and the routing data, and to pass the communication through the encrypted communication tunnel to the selected node device.
In another aspect, in general, the invention is software stored on a computer-readable medium for causing a programmable device, such as a node device or a general purpose computer, to provide secure communication services over a data network to multiple devices, such as node devices and general purpose computers, that are coupled to the node device through the data network. The software causes the programmable device to perform the functions of maintaining an encrypted communication tunnel with each of the plurality of other devices using the cryptographic information and routing communication, including accepting communication from a first of the multiple devices, the communication including an address to a second of the devices, to select one of the tunnels based on the address of the second device and the routing data, and to pass the communication through the selected encrypted communication tunnel to the other device.
In another aspect, in general, the invention is a communication system for providing secure communication services to multiple computers coupled over a data network. The system includes multiple node devices coupled to the data network, wherein each of the computers is coupled to the data network through at least one of the node devices. The system also includes a server computer coupled to the data network. The server is used for configuring the node devices, including for sending commands to the node devices to establish secure communication tunnels with other node devices. Each node device includes a network communication interface for coupling the node device to the data network, a data storage containing cryptographic information including information that is private to the node device, a tunneling communication service coupled to the network interface configured to maintaining an encrypted communication tunnel with each of the plurality of other node devices using the cryptographic information, a routing database for holding routing data, and a router coupled to the tunneling communication service and to the routing database. The router is configured to accept communication from a first of the computers that includes an address to a second of the computers, to select one of the other node devices based on the address of the second computer and the routing data, and to pass the communication through the encrypted communication tunnel to the selected node device.
In another aspect, in general, the invention is a method for providing secure communication services between multiple computers each coupled to a data network through one of multiple node devices. The method includes establishing secure communication tunnels over the data network between multiple pairs of the node devices, including accessing cryptographic information stored in the node devices and encrypting data passing between the pairs of node devices using the cryptographic information. The method also includes accepting communication from a first computer coupled to a first node device directed to a second computer coupled to a second node device, selecting a next node device based on an identification of the second local computer included in the accepted communication, passing the communication over a first of the secure communication tunnels to the next node device, and passing the communication from the next node device to the second local computer.
The method can include one or more of the following features:
The next node device can be different than the second node device to which the second computer is coupled, that is, the path to the second node device is indirect through the next node device. Passing the communication from the next node device to the second computer then includes passing the communication over a second of the secure communication tunnels from the next node device to the second node device.
The method further includes receiving routing data over the secure communication tunnels, and selecting the next node includes using the received routing data.
The method further includes accepting broadcasted communication from the first computer, for example a request for configuration data from the local computer, and forwarding the broadcast communication over one or more of the secure communication tunnels to other node devices.
Establishing the secure communication tunnels can include establishing a secure communication session with a server over the data network, including authenticating the node device by the server, and then accepting a command over the secure communication session from the server to establish a secure communication tunnel with another of the node devices. After accepting the command from the server, the method includes establishing a secure communication tunnel with the other of the node devices.
The method can further include generating the cryptographic information, including generating a public key and a private key for the node in the node device, storing the private key in a protected storage in the node device, and providing the generated public key for the node device to the server. Authenticating the node device by the server then includes encoding a message using the stored private key at the node device, sending the encoded message to the server, and decoding the message using the public key for the node device that was provided to the server.
In another aspect, in general, the invention is a method for configuring and authenticating a node device. The method includes the following steps. At a manufacturing facility, (a) generating a public key and a private key in the node device, (b) providing the public key to the manufacturing facility, and (c) storing the private key in a protected non-volatile storage in the node device. The node device is then deployed, including coupling the node device to a data network at a remote site, such as at a customer premises. At the remote site, the method then includes (d) accessing the stored private key, and (e) processing a message, for example generating a digital signature for the message, using the private key and sending the processed message over the data network to a server coupled to the data network. At the server, the method includes (f) receiving the processed message from the deployed node device, and (g) authenticating the node device including processing the received message using the public key that was generated in the device.
The method for configuring and authenticating a node device can further include, at the manufacturing facility, (b1) creating an authentication chain, including generating a certificate, for instance a standard X.509 format certificate, signed with a private key associated with the manufacturing facility and including the public key provided by the node device to the manufacturing facility. The authentication chain may also include a root public key, a root certification, or a chain of certificates, that are used to authenticate the node device. The method then further includes (b2) providing the authentication chain to the node device, and (b3) storing the authentication chain in a non-volatile storage in the node device. Then, at the remote site, the method can further include (e1) sending the authentication chain to the server over the data network.
The method for configuring and authenticating a node device can further include, prior to sending the authentication chain to the server, accepting an identification for the server and an address on the data network of the server to which the authentication chain is sent.
The method can also include receiving a certificate from the server, and authenticating the server using the accepted certificate and the accepted identification of the server.
The method can also include, at the manufacturing facility, providing an identifier of the node device to the manufacturing facility, wherein the generated certificate includes the identifier. Authenticating the node device then includes accessing said identifier provided in the certificate.
The method for configuring and authenticating a node device can further include, at the server, (h) after authenticating the node device, sending a response to the node device that includes a challenge message, and, at the remote device, (i) receiving the response that includes the challenge message, processing the challenge message using the stored private key, and sending the processed challenge message to the server, thereby allowing the server to determine that the sender of the processed challenge message has the private key of the node device.
The invention includes one or more of the following advantages:
Automated installation, configuration, operation, and management of VPNs requires little or no manual configuration or on-site maintenance.
Dynamic connectivity of computers through a mesh topology VPN network permits content packets to be easily and efficiently re-routed through mesh-topology, depending on the application requirements of the user""s organization. VPN devices can incorporate the necessary intelligence to optimize network bandwidth by integrating dynamic routing with VPN technology. VPN-based networks can also automatically adapt to changes in network topology.
The communication system provides comprehensive security to guarantee the safe transmission of mission-critical data over public networks. In addition to the secure encryption and authentication of content, the protocols and processes used to manage node devices from a central server are also secure. The control information exchanged between management server(s) and VPN devices is securely authenticated, encrypted, and protected from replay and other spoofing attacks.
The centralized management functionality results in simplicity of VPN setup and maintenance. For example, all security policy information, key parameters (such as type, strength, rollover times) and connectivity information are maintained in a central management system. This permits a network manager to handle operations from a single control point and it relieves branch offices and users from employing on-site technicians or administrators.
Dynamic routing enables the creation of meshed VPN network topologies. The optimum path is automatically selected based on security policy, setup connections, and routing parameters to optimize bandwidth, save time, and reduce operating costs. On a larger scale, users can form communities of interest by creating their own virtual networks within existing enterprise topologies using private or public networks. Dynamic VPN switches can handle thousands of simultaneous active users, and can interconnect with hundreds of other dynamic VPN switches.
Using multiple sets of tunnels, or domains, between which the routers in the node devices do not forward communication, the different domains can form xe2x80x9ccommunities of interestxe2x80x9d within a larger domain. For instance, different divisions in a corporation may have different domains within a corporate network. Access to a domain occurs at the first node device that accepts communication from a computer that is authorized to communicate with that domain. When communication is sent from node to node, the content of the communication does not have to be reexamined at each node to determine whether it should be forwarded to particular computers, since that communication is already associated with a particular domain based on the tunnel it arrived on. This avoids an expensive step of filtering packets multiple times as they pass from source to destination, thereby providing higher data rates as compared to a distributed filtering approach.
Other features and advantages of the invention are apparent from the following description, and from the claims.